As reported by BleepingComputer, a federal grand jury has indicted two Canadian nationals — Ryan James Roach, 35, and Mathiew James Stubbings, 41 — for hacking multiple US universities across New York, Tennessee, North Carolina, and Massachusetts between June 2016 and December 2019. The alleged scheme involved deploying cryptocurrency mining malware and credential-stealing tools via VPN servers registered under false identities across multiple countries. The defendants specifically targeted institutions with supercomputers, using compromised systems for reconnaissance, lateral movement, and even vulnerability research.

Key Takeaway: The alleged scheme involved deploying cryptocurrency mining malware and credential-stealing tools via VPN servers registered under false identities across multiple countries.

While this case spans activity from nearly a decade ago, the underlying attack pattern remains disturbingly relevant. Academic institutions continue to be disproportionately targeted for cryptojacking operations, and the structural reasons haven't changed.

Why Universities Remain Prime Targets

University networks present a unique combination of characteristics that threat actors find irresistible:

Why Universities Remain Prime Targets
Massive compute resources: Supercomputers and research clusters offer orders of magnitude more hashing power than commodity endpoints, making them highly attractive for cryptocurrency mining.
Open culture and broad access: Academic environments prioritize collaboration and information sharing, which often translates to permissive network policies and large numbers of user accounts with elevated privileges.
Heterogeneous infrastructure: University networks typically blend legacy systems, diverse research labs, cloud environments, and shared computing clusters — creating a complex attack surface with inconsistent security controls.
Rotating user base: Frequent turnover of students, researchers, and visiting scholars makes identity lifecycle management difficult, creating opportunities for credential abuse and orphaned accounts.
Understaffed security teams: Despite managing enterprise-scale infrastructure, many university IT security teams operate with fewer personnel and smaller budgets than comparably-sized private sector organizations.

The Operational Playbook: Still Effective

The DOJ's description of the defendants' methodology reads like a standard cryptojacking playbook that remains in active use today. The use of VPN servers in multiple jurisdictions with fake registrations is a classic operational security technique designed to frustrate attribution. The sequence — initial access, credential theft, reconnaissance, lateral movement, and persistence via mining software deployment — mirrors what we see in contemporary intrusions targeting academic and research computing environments.

The attackers didn't just mine cryptocurrency; they used compromised supercomputer access to conduct vulnerability research, suggesting a secondary objective of discovering additional exploitation opportunities or potentially selling access to other threat groups.

This dual-purpose intrusion pattern — cryptojacking as a primary revenue stream with reconnaissance as a secondary objective — deserves more attention from defenders. Too often, cryptojacking is treated as a nuisance crime rather than an indicator of deeper network compromise. Any unauthorized mining software on a network should trigger a full investigation, not simply removal of the malware.

Shield53 Recommendations

For academic institutions, research organizations, and any environment with high-performance computing assets, we recommend the following defensive measures:
  • Implement compute resource monitoring: Deploy dedicated monitoring on HPC clusters and research computing infrastructure to detect abnormal CPU/GPU utilization patterns indicative of unauthorized mining operations.
  • Tighten credential hygiene: Enforce privileged access management for all administrative and service accounts on research computing systems. Implement just-in-time access and regular access reviews, particularly for shared research computing environments.
  • Network segmentation for research computing: Isolate supercomputer and HPC cluster management networks from general campus infrastructure. Restrict inbound connections and implement strict egress filtering to prevent C2 communication and data exfiltration.
  • Threat hunting for mining indicators: Develop detection rules for known mining pools, stratum protocol traffic, and common cryptojacking process names. Monitor for unexpected outbound connections from compute nodes that should only communicate with job schedulers and storage systems.
  • Incident response readiness: Treat any cryptojacking detection as a full-scope incident. Don't assume the attacker's only objective was mining — investigate for credential theft, lateral movement, and persistence mechanisms.
  • Collaboration with law enforcement: Academic institutions should establish proactive relationships with FBI field offices and CISA cybersecurity advisors before incidents occur, not after. Rapid information sharing can help connect seemingly isolated intrusions to broader campaigns.

The fact that this indictment comes years after the alleged activity underscores the patience of law enforcement but also the long dwell times that threat actors enjoyed on these networks. For university security teams, the lesson is clear: assume your high-value compute assets are being actively targeted, and invest in the monitoring and detection capabilities needed to catch intrusions early rather than discovering them through post-incident forensic analysis or law enforcement notification.